bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 14:37:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(credential-sharing): implement the Credential Sharing OpenSpec (M1-M3)

Browse source 
New @logicsrc/plugin-credential-sharing: a provider-neutral secret-sync engine
with env/.env, Doppler, Railway, and GitHub Secrets adapters behind one
CredentialProvider contract.

- engine: inspect -> diff -> plan -> approve -> sync -> rollback -> audit/export
- dry-run is the default for sync; --approve writes; destructive changes gated
- fingerprint-based diffs (salted SHA-256); raw values never printed or stored in
  plans/runs/audit; rollback pre-image kept in a 0600 .logicsrc vault (gitignored)
- github-secrets is write-only for values (sealed-box via libsodium), so it cannot
  be a sync source or value-restoring rollback target
- CLI: real `logicsrc credentials <providers|inspect|diff|plan|approve|sync|
  rollback|audit|export>` (replaces the prior stub)
- 4 JSON schemas registered in @logicsrc/validators
- flip logicsrc.com/credential-sharing band from coming-soon to available
- 37 tests pass; full env->env lifecycle verified; artifacts schema-validate

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-27 15:24:30 +00:00
parent 6e7f44612a
commit cf73fe5af2
30 changed files with 1849 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

6
packages/schemas/package.json
View file

@ -32,7 +32,11 @@
"./agentad-ad-response": "./schemas/agentad-ad-response.schema.json",
"./agentad-impression": "./schemas/agentad-impression.schema.json",
"./agentad-click": "./schemas/agentad-click.schema.json",
"./agentad-campaign": "./schemas/agentad-campaign.schema.json"
"./agentad-campaign": "./schemas/agentad-campaign.schema.json",
"./credential-provider": "./schemas/logicsrc-credential-provider.schema.json",
"./credential-sync-plan": "./schemas/logicsrc-credential-sync-plan.schema.json",
"./credential-sync-run": "./schemas/logicsrc-credential-sync-run.schema.json",
"./credential-audit-event": "./schemas/logicsrc-credential-audit-event.schema.json"
},
"files": [
"schemas"

32
packages/schemas/schemas/logicsrc-credential-audit-event.schema.json Normal file
View file

@ -0,0 +1,32 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schemas.logicsrc.com/logicsrc-credential-audit-event.schema.json",
"title": "LogicSRC Credential Audit Event",
"type": "object",
"required": ["type", "id", "provider", "action", "key", "target", "principal", "decision", "dryRun", "createdAt"],
"additionalProperties": false,
"properties": {
"type": { "const": "logicsrc.credential_audit_event" },
"id": { "type": "string", "minLength": 1 },
"runId": { "type": "string", "minLength": 1 },
"planId": { "type": "string", "minLength": 1 },
"provider": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
"action": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*(:[a-z][a-z0-9_-]*)+$" },
"key": { "type": "string", "minLength": 1 },
"target": { "type": "string", "minLength": 1 },
"fingerprint": { "type": "string" },
"principal": {
"type": "object",
"required": ["type", "id"],
"additionalProperties": false,
"properties": {
"type": { "enum": ["user", "agent", "workflow", "plugin"] },
"id": { "type": "string", "minLength": 1 },
"trusted": { "type": "boolean" }
}
},
"decision": { "enum": ["allow", "approval_required", "deny"] },
"dryRun": { "type": "boolean" },
"createdAt": { "type": "string", "format": "date-time" }
}
}

28
packages/schemas/schemas/logicsrc-credential-provider.schema.json Normal file
View file

@ -0,0 +1,28 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schemas.logicsrc.com/logicsrc-credential-provider.schema.json",
"title": "LogicSRC Credential Provider",
"type": "object",
"required": ["id", "name", "description", "capabilities", "authRequirements", "status"],
"additionalProperties": false,
"properties": {
"id": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
"name": { "type": "string", "minLength": 1 },
"description": { "type": "string", "minLength": 1 },
"capabilities": {
"type": "object",
"required": ["readValues", "readNames", "write", "delete", "rollback", "audit"],
"additionalProperties": false,
"properties": {
"readValues": { "type": "boolean" },
"readNames": { "type": "boolean" },
"write": { "type": "boolean" },
"delete": { "type": "boolean" },
"rollback": { "type": "boolean" },
"audit": { "type": "boolean" }
}
},
"authRequirements": { "type": "array", "items": { "type": "string" } },
"status": { "enum": ["available", "planned"] }
}
}

56
packages/schemas/schemas/logicsrc-credential-sync-plan.schema.json Normal file
View file

@ -0,0 +1,56 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schemas.logicsrc.com/logicsrc-credential-sync-plan.schema.json",
"title": "LogicSRC Credential Sync Plan",
"type": "object",
"required": ["type", "id", "from", "to", "policy", "changes", "requiresApproval", "createdAt"],
"additionalProperties": false,
"$defs": {
"endpoint": {
"type": "object",
"required": ["provider"],
"additionalProperties": false,
"properties": {
"provider": { "type": "string", "minLength": 1 },
"path": { "type": "string" },
"project": { "type": "string" },
"config": { "type": "string" },
"service": { "type": "string" },
"scope": { "type": "string" },
"metadata": { "type": "object" }
}
},
"change": {
"type": "object",
"required": ["key", "op", "destructive"],
"additionalProperties": false,
"properties": {
"key": { "type": "string", "minLength": 1 },
"op": { "enum": ["add", "update", "remove", "unchanged", "unknown"] },
"sourceFingerprint": { "type": "string" },
"targetFingerprint": { "type": "string" },
"destructive": { "type": "boolean" }
}
}
},
"properties": {
"type": { "const": "logicsrc.credential_sync_plan" },
"id": { "type": "string", "minLength": 1 },
"from": { "$ref": "#/$defs/endpoint" },
"to": { "$ref": "#/$defs/endpoint" },
"policy": {
"type": "object",
"required": ["redactValues", "requireApprovalForDestructive"],
"additionalProperties": false,
"properties": {
"redactValues": { "const": true },
"requireApprovalForDestructive": { "type": "boolean" },
"denyKeys": { "type": "array", "items": { "type": "string" } }
}
},
"changes": { "type": "array", "items": { "$ref": "#/$defs/change" } },
"requiresApproval": { "type": "boolean" },
"rollbackOfRunId": { "type": "string", "minLength": 1 },
"createdAt": { "type": "string", "format": "date-time" }
}
}

35
packages/schemas/schemas/logicsrc-credential-sync-run.schema.json Normal file
View file

@ -0,0 +1,35 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schemas.logicsrc.com/logicsrc-credential-sync-run.schema.json",
"title": "LogicSRC Credential Sync Run",
"type": "object",
"required": ["type", "id", "planId", "status", "dryRun", "results", "auditEventIds", "reversible", "startedAt", "finishedAt"],
"additionalProperties": false,
"properties": {
"type": { "const": "logicsrc.credential_sync_run" },
"id": { "type": "string", "minLength": 1 },
"planId": { "type": "string", "minLength": 1 },
"status": { "enum": ["planned", "dry_run", "applied", "partial", "failed", "rolled_back"] },
"dryRun": { "type": "boolean" },
"results": {
"type": "array",
"items": {
"type": "object",
"required": ["key", "op", "applied", "dryRun"],
"additionalProperties": false,
"properties": {
"key": { "type": "string", "minLength": 1 },
"op": { "enum": ["add", "update", "remove", "unchanged", "unknown"] },
"applied": { "type": "boolean" },
"dryRun": { "type": "boolean" },
"targetFingerprint": { "type": "string" },
"error": { "type": "string" }
}
}
},
"auditEventIds": { "type": "array", "items": { "type": "string" } },
"reversible": { "type": "boolean" },
"startedAt": { "type": "string", "format": "date-time" },
"finishedAt": { "type": "string", "format": "date-time" }
}
}